Malicious code in css-gvqmfn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb3f332a818748252e49dcf21ffb6949c531afd401ee697cc08ba00a067ae30 css-gvqmfn-polyfill mimics Wix internal @wix/thunderbolt- CSS polyfill naming and ships a Proxy-based cover stub that re-exports registry names...

Malicious code in css-ayucyz-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a On require, thunderboltRegistry.js runs an IIFE that acquires childprocess via multiple fallbacks and executes shell commands id, whoami, uname -a,...

MAL-2026-17548 Malicious code in css-ayucyz-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a On require, thunderboltRegistry.js runs an IIFE that acquires childprocess via multiple fallbacks and executes shell commands id, whoami, uname -a,...

Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles...

MAL-2026-17542 Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

polytracker

PolyTracker PolyTracker es una herramienta creada originalmente para la Automated Lexical Annotation and Navigation of Parsers , un backronym ideado únicamente para el propósito de referirse a ella como The ALAN Parsers Project. Sin embargo, ha evolucionado hasta convertirse en una herramienta de...

samsung-exynos-sms-stack-overflow-cve-2025-54328-critical-zero-click-baseband-rce

CVE-2025-54328 — Desbordamiento de búfer de pila en SMS RP-DATA de Samsung Exynos PoC conceptual para CVE-2025-54328, un desbordamiento de búfer de pila crítico CVSS 10.0 en el analizador SMS RP-DATA del firmware de banda base de Samsung Exynos. Artículo Artículo completo: Samsung Exynos...

CVE-2025-6980-check

Verificación de Divulgación de Información Sensible de Arista NGFW Escáner Arista NGFW CVE-2025-6980 por Bishop Fox Prueba un objetivo para la divulgación de información CVE-2025-6980 No realiza ninguna acción administrativa en el objetivo Para más información sobre esta vulnerabilidad, consulte ...

CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule inyección SQL en ORDER BY Reproductor de prueba de concepto ejecutable para la inyección SQL en la consulta de reglas de alerta de auditoría de Apache InLong. El mapper del manager de InLong AuditAlertRuleEntityMapper.selectByCondition filtra con...

CVE-2026-105179

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/adduser.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...

Joomla! Core SQL Injection

A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. id: CVE-2015-7297 info: name: Joomla! Core SQL Injection author: princechaddha severity: high description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote...

CVE-2022-3689

Informe de análisis de CVE-2022-3689 Resumen CVE-2022-3689 es una vulnerabilidad de inyección SQL descubierta en un plugin específico de WordPress, que permite a un atacante aprovechar la vulnerabilidad de seguridad de la aplicación web para insertar código SQL malicioso en la base de datos. Esto...

CVE-2024-24919-POC

PoC de CVE-2024-24919 🚀 🔥 Descripción Este script automatiza la explotación de CVE-2024-24919 Divulgación no autorizada de información de Checkpoint Security Gateway. 📌 Características ✅ Prueba de URLs individuales y en masa ✅ Explotación automatizada ✅ Simple y rápido 🛠️ Uso Clona este repositori...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: Fuga de secreto en ZTE H298A / H108N a través de ETHCheat Desglose técnico de CVE-2026-34474, donde una solicitud no autenticada ETHCheat=1 provoca que los routers ZTE ZXHN H298A 1.1 y H108N 2.6 afectados devuelvan la contraseña de administrador activa, el ESSID y la PSK de WLAN e...

CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

EUVD-2026-92156

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

CVE-2026-105292

The software Chaterm before version 0.12.1 is vulnerable to a login cross-site request forgery (CSRF) . The root cause is a lack of OAuth state validation when processing chaterm:// callbacks. A remote attacker can trigger a crafted callback from a web page to inject attacker-controlled userInfo....